Hacker News Reader

Comment by mrtksn | Hacker News Reader

If anyone who used the service, do you know if you can use it anonymously? I wanted to try it but I was afraid of exactly this.

How feasible it is to use a payment and an address that doesn't directly connect you to your samples?

View on HN

Given the nature of the service, you should probably treat it as inherently pseudonymous. You're handing over irrevocable genetic data which will link you to relatives. Whatever their data protection assurances are, you have to imagine the worst case scenario - massive data leakage. And if this happens then you will in all likelihood be identifiable.

Obviously I don't trust any assurances, but on the other hand I'm handing over my genetic data all the time because parts of me end up over in the hands of 3rd parties whenever I go outside but they just happen not to run test on those.

If I can have a test that is not connected to my persona, from their perspective the data would be as valuable as running a test on the hair in the barbershop or picking a random leftover of food and running test on the saliva left on the half consumed food.

There's quite a big difference between the DNA you leave in a forensic sense all around you (which would take a lot of effort and expense for someone to gather against your will) versus serving it up on a plate in a format that is trivially searchable for close matches against any relatives. The value is in the fact that millions of people's DNA is gathered in the same place in the same format, not the individual value of your DNA. It's a classic network effect.

What's the difference of taking the DNA from a trash and from a plate delivered with fake information?

I mean, what is your threat model, and what are you trying to get out of DNA/ancestry services?

If you're worried about getting arrested for one of the many crimes you've committed, and you want to meet far-flung relatives, you're kind of in a bind here. Assuming unlimited cooperation between the police and the DNA/ancestry services -- which your threat model in this case would require -- even if they don't have your name or address, they could fabricate a half-sibling/double-cousin in the system and have them reach out to you. What, are you not going to talk to and eventually meet the cop pretending to be your previously unknown half-sibling/double-cousin?

My threat model is about the changing world, essentially activist who feel like having right to tell who lives where. I usually pass by the look, fail by the accent and I intend not to have another data point they can use.

I wouldn't count on any data protections from firms in the United States. There's no responsibility taken by those with the influence to end lives.

Until there's actual punishment for being breached, there will never be data protections in the United States. Even HIPAA and the DMV sell access to businesses.

indeed, if you have a cousin that has already filled in the data about your grandparents, and they do a scan showing "John Doe" is the descendent of Arthur, Betty, Charlie, and Debbie; then you're already linked with a "shadow profile". Chances are they'll have the data from your cousin with your name added too, so now they can link the DNA of "John Doe" with the shadow profile of "YourActualName, cousin of Timmy TakeMyData".

The only solution to this is regulation and enough incentive that companies have to treat data as they treat radioactive waste material. Storing data should be a liability, not an asset.

I used a fake name and a masked email address, and no issues so far. I've told close family members that if they get a sibling, child, or uncle show up called "James Brown" not to freak out too much

I had the same question once and dug around the internet a bit. It seems like they don't verify your information.

I'd recommend to use a fake name and not something like "Ano Nymous" as their rules don't allow that.

Right, if they don't do any extra verification on identity then non-perosonal mailing address and a single use payment method should do.

You DNA is shared with others, so any amateur geneaologist is likely to be able to find out who, approximately, you are.

The exact info though should be easy to protect. Just dont give it away.

But remember that other close family members to you are very likely to know who you are, and they may share that info by accident. Normally you can't share data of anyone living on these services, since that is illegal pretty much anywhere, but its enough if one user happen to mark you dead in their tree and has filled in your real data.

I signed up with fake name, delivered to a friends address, and a Privacy.com single use credit card. No one is forcing you to use real credentials anywhere online.

there is no credential more comprehensively solid than your genome

Yeah it's sort of like using Tor to log in to Facebook and expecting Facebook not to know who you are because your IP is obscured.

More like using Tor to create a FB account with made up information and expecting FB not know who you are because your IP is obscured and you use fresh browser profile. In your DNA doesn't tell your identity, there's DNA everywhere and it's not something hard to come by. The analysis is only valuable if can be connected to a persona, otherwise its just chemical reaction.

No, your analogy makes no sense. A fake facebook account is not identifying information. DNA is. They can figure out who you are based on the DNA alone, if they have enough data from your relatives.

There are billions of addresses in the world and you can look it up online. It is an identifying information only when it is attached to an identity. That's exactly the same. DNA is everywhere, it's only identifying when connected to an identity.

It can be tied to your identity, that's the point. Because they'll have your relatives' data.

They can match me with my DNA if they already have complete knowledge of my family structure and all their DNA. So if all Kardashians but one send their DNA for tests providing their true identities and the last one sends anonymously, they can assume the identity of the last one.

So yes, there's a risk but its not much different from going outside and leave behind hair or saliva unaccounted for. That's Putin level of paranoia IMHO(he is known to have men collecting his poo etc. when outside).

Maybe can be useful for insurance companies to match you and price you according to your DNA but they are not allowed to do that and they can only exist within legal structure.

> They can match me with my DNA if they already have complete knowledge of my family structure and all their DNA.

Or just a part of it, which is the point: no, complete knowledge isn't required here.

> No one is forcing you to use real credentials anywhere online.

Definitely not true, many services require KYC and others do it to prevent fraud.

Find a private lab to do the test. It may be a bit more involved, and cost more money, but not by that much.

Do private labs have methods to provide similar information to 23andMe?

The labs don't, but you could upload it to promethease. But they play a role similar to 23andMe so likely it wouldn't address your concerns.

Reply on news.ycombinator.com